Privacy Policy

Last updated: 4 October 2026

This policy explains how Zerxis Limited (“Zerxis”, “we”, “us”) collects, uses, shares and protects personal data through Call Center Africa, our contact-centre platform at https://callcenter.africa, its mobile apps (including the Helpline app) and related services (together, the “Service”). It also explains your rights under the Kenya Data Protection Act, 2019 (the “DPA”).

1. Who we are

Zerxis Limited is a company incorporated in Kenya, of P.O. Box 777-00200, Nairobi, Kenya. We are registered with the Office of the Data Protection Commissioner (ODPC) as a data controller, registration number 00114/1.

For any privacy question or request, contact us at info@zerxis.com or +254 707 077 707.

2. Our two roles

When we act as data controller. We decide how and why personal data is used for our own business: people who visit our websites, contact us, use our own WhatsApp number, or hold login accounts on the Service, and our clients’ billing and business contacts.

When we act as data processor. Our clients are organisations that use the Service to call, message and serve their own customers. For the personal data of those customers (for example call recordings, call records, phone numbers, messages and contact lists), the client is the data controller and we process the data only on the client’s documented instructions, under our agreement with that client. If you are a customer of one of our clients, please read that organisation’s privacy notice and send requests about your data to them. We will help them respond.

3. Personal data we collect

3.1 As controller

Contact and enquiry details: your name, organisation, email address, phone number and the content of your message when you fill in a form, email us, call us or message our WhatsApp number.
Account details: the name, email address, phone number, role and login credentials of people who use the Service on behalf of a client, and records of their activity in the Service (for example log-ins and actions taken).
Billing details: the names and contact details of a client’s finance and business contacts, invoices and payment records.
Technical data: IP address, browser and device type, and pages visited, collected by our servers and through cookies when you use our websites.
Sign-in through Google: if you choose to sign in with a Google account, we receive your name and email address from Google.

3.2 As processor, on behalf of clients

Phone numbers and call records (time, duration, outcome) of calls made or received through the Service.
Call recordings, where the client has turned recording on.
Keypad and voice responses to automated calls and IVR menus.
SMS and WhatsApp messages sent or received through the Service.
Contact lists and other records the client uploads or connects to the Service.

4. How we use personal data and our lawful basis

To provide the Service and support our clients (performance of a contract).
To keep the Service secure and working, including monitoring, troubleshooting and preventing fraud and misuse (our legitimate interests).
To answer enquiries and send information you asked for (your request or our legitimate interests).
To send updates about our services to business contacts, which you can opt out of at any time (our legitimate interests, or consent where the law requires it).
To invoice, keep accounts and meet our legal obligations, including tax and regulatory requirements (legal obligation).

Data we process for clients is used only to provide the Service to that client, as set out in our agreement with them.

5. Artificial intelligence and call data

Some features of the Service use artificial intelligence, for example text-to-speech for automated calls or transcription, when a client turns them on. These features process data only to provide the Service to that client.

We do not use call recordings, messages or other data we process for clients to train AI models, and we do not share or license that data to AI developers or other third parties, unless the client has signed a separate written agreement with us that allows it. Any such use must also comply with the DPA.

6. WhatsApp

Zerxis is a Meta Tech Provider. Where WhatsApp is used through the Service, the WhatsApp Business Platform (Cloud API) applies, as follows.

WhatsApp messages sent or received through the Service are delivered through Meta’s Cloud API and processed by Meta Platforms on Meta’s infrastructure, under Meta’s terms and policies. Message records kept in the Service are stored as described in section 9.
Each client that uses WhatsApp through the Service has its own WhatsApp Business Account, is the controller of its customers’ messages, and is responsible for getting customers’ opt-in before sending them messages the customer did not start.
If you message Zerxis’s own WhatsApp number, we use your number and messages to reply to you and to keep a record of our conversation.

7. The Helpline mobile app

The app asks for device permissions, such as the microphone, notifications and contacts, only for the features that need them, for example making calls and showing incoming calls. You can withdraw any permission in your device settings, though some features may then stop working.
The app can set up a secure connection (VPN) between your device and Zerxis servers to carry calls. We use this connection only to provide calling. We do not use it to collect, monitor or sell information about your other internet activity.
To deliver call and message notifications, the app uses a push notification service operated by Google.

8. Who we share personal data with

We do not sell personal data. We share it only as needed to provide the Service, with:

Telecommunications carriers, such as Safaricom, to connect calls and deliver SMS.
Meta Platforms, for WhatsApp messaging as described in section 6.
Technology service providers that support the Service, such as text-to-speech, transcription, push notifications, email delivery, error monitoring and website analytics (Google Analytics). They may use the data only to provide their service to us.
Professional advisers, such as our lawyers, accountants and auditors, where needed.
Authorities, such as courts, regulators and law enforcement, where the law requires it. We review such requests and share no more than the law requires.
A buyer or successor, if all or part of our business is sold or restructured, subject to this policy.

9. Where data is stored and transfers outside Kenya

Production workloads run on infrastructure operated by Zerxis, not shared public cloud. Hosting locations for each client are set out in their data processing agreement.

Some processing takes place outside Kenya, for example by Meta for WhatsApp messages and by other service providers listed in section 8. We transfer personal data outside Kenya only as the DPA allows, including where appropriate safeguards are in place to protect it. You can ask us for more information about these transfers.

10. How long we keep personal data

Client data we process as processor is kept for as long as the client instructs, under its retention settings and our agreement. When the agreement ends, we return or delete it as that agreement provides.
Account details are kept while the account is active and then deleted, unless we need them for the reasons below.
Enquiries are kept for as long as needed to deal with them and any business relationship that follows.
Invoices and accounting records are kept for as long as Kenyan tax and company law requires, generally at least five years.
We may keep data longer where it is needed to establish, exercise or defend legal claims.

11. How we protect personal data

We use technical and organisational measures appropriate to the risk, including access controls, separation of client environments, audit logging and encryption on supported connections. No system is completely secure. If a personal data breach occurs that is likely to put people’s rights at risk, we will notify the ODPC and, where required, the people affected, as the DPA requires. Where we act as processor, we will also notify the client without delay.

12. Your rights

Under the DPA, you have the right to:

be informed of how your personal data is used;
access the personal data we hold about you;
object to processing of all or part of your personal data;
have false or misleading data corrected, and have data deleted where we have no lawful reason to keep it;
ask us to restrict processing in certain circumstances;
receive data you provided to us in a portable format, where the DPA allows; and
not be subject to a decision based only on automated processing that significantly affects you, except where the DPA allows it.

To use any of these rights, email info@zerxis.com. We may need to confirm your identity first. We will respond within the time set by the Data Protection (General) Regulations, 2021. If your request concerns data we hold for one of our clients, we will pass it to that client and help them respond.

If you are not satisfied with our response, you can complain to the Office of the Data Protection Commissioner at www.odpc.go.ke.

13. Cookies

Our websites use cookies that are needed to sign you in, keep your session secure and remember your settings, such as language. We may also use analytics cookies to understand how our websites are used. You can block or delete cookies in your browser settings, but parts of the Service may not work without the essential ones.

14. Children

The Service is for organisations and is not directed at children. We do not knowingly collect personal data directly from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

15. Changes to this policy

We may update this policy from time to time. We will post the new version on this page with a new “Last updated” date, and where changes are significant we will let clients and account holders know by email or through the Service.

16. Contact us

Zerxis Limited
P.O. Box 777-00200, Nairobi, Kenya
Email: info@zerxis.com
Phone: +254 707 077 707
ODPC registration number: 00114/1